---
title: "Authenticating TeamCity Builds to External Services With OIDC"
description: "Static CI/CD credentials can leak through logs or artifacts, expose uncertainty over who copies them, and require rotation, so the article presents OIDC as an alternative for authenticating TeamCity builds. It explains the workload flow: an identity provider issues a signed JWT whose claims include validity, audience, and issuer, while the consuming service retrieves metadata and JWKS, verifies the signature, and checks those claims. The TeamCity OIDC JWT plugin makes the server an identity provider, supports RSA- or ECDSA-based signing, key rotation, configurable public issuer hosting, and extensions for HSMs or key-management services. After installation from JetBrains Marketplace, build configurations can issue tokens at startup or on demand, with default or fixed five-minute lifetimes, for direct presentation or token exchange with AWS, Google Cloud, and other OIDC services."
---

# Authenticating TeamCity Builds to External Services With OIDC

[Jetbrains](https://yomu.fyi/company/jetbrains) · Igor Brovtsin · Sep 1, 2026

**Type:** Tutorial

## Summary

Static CI/CD credentials can leak through logs or artifacts, expose uncertainty over who copies them, and require rotation, so the article presents OIDC as an alternative for authenticating TeamCity builds. It explains the workload flow: an identity provider issues a signed JWT whose claims include validity, audience, and issuer, while the consuming service retrieves metadata and JWKS, verifies the signature, and checks those claims. The TeamCity OIDC JWT plugin makes the server an identity provider, supports RSA- or ECDSA-based signing, key rotation, configurable public issuer hosting, and extensions for HSMs or key-management services. After installation from JetBrains Marketplace, build configurations can issue tokens at startup or on demand, with default or fixed five-minute lifetimes, for direct presentation or token exchange with AWS, Google Cloud, and other OIDC services.

## Context

Static credentials in CI/CD environments can be leaked through logs and build artifacts, copied or shared during setup, and require regular rotation. OIDC provides a way for CI/CD pipelines to authenticate with short-lived identity tokens instead.

## Approach / What changed

The TeamCity OIDC JWT plugin makes the TeamCity server an identity provider for third-party OIDC services. It supports RSA- and ECDSA-based signing, key rotation, configurable issuer hosting, JWKS publication, and build features that issue tokens at build start or on demand through HTTP requests.

## Takeaways

- OIDC consumers validate a JWT by retrieving issuer metadata and JWKS, verifying its signature, and checking its audience and validity period.
- The startup token feature stores a configurable-lifetime token in a build parameter; the on-demand HTTP feature issues tokens with a fixed five-minute lifetime.
- The plugin supports publicly accessible and internet-inaccessible TeamCity instances, including configurable public issuer URLs and extension points for HSMs or services such as Google Cloud KMS.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [CI/CD](https://yomu.fyi/topic/ci-cd), [OIDC](https://yomu.fyi/topic/oidc), [TeamCity](https://yomu.fyi/topic/teamcity)

- Source: [Jetbrains](https://blog.jetbrains.com/teamcity/2026/09/authenticating-teamcity-builds-with-oidc)
- Source URL: https://blog.jetbrains.com/teamcity/2026/09/authenticating-teamcity-builds-with-oidc
- Ingested by Yomu: 2026-09-03T11:17:07.233Z

[Read original post](https://blog.jetbrains.com/teamcity/2026/09/authenticating-teamcity-builds-with-oidc)